blocks|key|2772310|text|我想知道，这是否有可能使程序崩溃与分割，违规信号或类似的事情。|type|blockquote|depth|inlineStyleRanges|entityRanges|data|2772311|是。取消引用已删除的指针是未定义的行为。其中一件事可能会发生，那就是坠机。另一个原因是程序可以在没有任何问题的情况下悄然退出。|unstyled|2772312|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|H|8|@]|9|@]|A|$]]|$1|E|3|-4|5|D|7|I|8|@]|9|@]|A|$]]]|F|$]]

<blockquote>
 I wonder if it is possible that this makes crash the program with a segmentation violation signal or such kind of thing.
</blockquote>

Yes. De-referencing a deleted pointer is undefined behaviour. One of the things could happen is a crash. Another is that the program could silently exit without any problems.

blocks|key|599530|text|是的，不应该使用释放的内存。|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|599531|释放或删除堆分配内存后的使用会导致未定义的系统行为。|599532|有时它可能会显示工作，有时它不工作，这取决于您释放的内存是否被重用。|599533|entityMap^0|3|5|0|H|8|0|8|2|0^^$0|@$1|2|3|4|5|6|7|L|8|@$9|M|A|N|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|O|8|@$9|P|A|Q|B|C]]|D|@]|E|$]]|$1|H|3|I|5|6|7|R|8|@$9|S|A|T|B|C]]|D|@]|E|$]]|$1|J|3|-4|5|6|7|U|8|@]|D|@]|E|$]]]|K|$]]

Yes, you should never work on freed memory.

The use of heap allocated memory after it has been freed or deleted leads to undefined system behavior.

Sometimes it could appears to work, sometimes it does not work, depending if your freed memory is reused.

blocks|key|2772358|text|ptr仍然包含一个内存地址。是否在进程上下文中访问此特定地址取决于操作系统内存管理的状态，以及系统的C%2B%2B编译器的堆管理是否会返回由于删除而释放的内存到OS内存管理。如果它消失了，你会看到一个片段违规。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2772359|但是，访问地址仍然是可能的，并且您的程序不会因为非法侵入而终止。但是，即使这是确定的，您也无法保证main返回的值仍然是删除之前保存的变量的值。堆内存管理是一个非常复杂的软件，在返回内存块时不知道会发生什么。|2772360|最后，如果您的程序使用线程，另一个线程可能已请求内存，并接收并更改了几纳秒前返回的内容。|2772361|所以:不要，永远不要！|2772362|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|J|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|K|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|L|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|M|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|I|$]]

ptr still contains a memory address. Whether or not accessing this particular address in the context of your process depends on the state of the operating system's memory management and whether the heap management of your system's C++ compiler might return memory freed due to delete to the OS memory management. If it's gone, you'll see a segment violation. 

But chances are that accessing the address is still possible and your program won't be terminated due to trespassing. But even if this is certain, you won't have any guarantee that the value returned from main is still the value the variable held before the delete. Heap memory management is a very intricate piece of software and there's no telling what happens to the chunk of memory while it is returned.

Finally, if your program uses threads, another thread may have requested memory and received and changed what was returned a few nanoseconds ago.

So: don't, never, ever!

blocks|key|2772391|text|是的，它真的会崩溃;)|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2772392|但是，您的例子实际上太简单了，不可能崩溃。为了让您的示例崩溃，您的进程(标准C库)必须在delete命令中将内存返回给操作系统。因为现在大多数系统上的内存都是分页组织，所以您必须分配足够大的内存，这样当释放内存时，整个页面就会被释放并返回到操作系统。当您访问未映射的内存时会发生分段错误--这是返回到操作系统的内存的情况。但是，您分配的内存太少，这是不可能的。|offset|length|style|CODE|2772393|如果你想崩溃，给系统更多的机会:)|2772394|#include+<stdio.h>
#include+<string.h>

//+number+of+megabytes+you+will+allocate
#define+N+100
+
int+main()
{
++++++++char+*ptr[N];
++++++++int+i;

++++++++for+(i+=+0;+i+<+N;+i%2B%2B)+{
++++++++++++++++ptr[i]+=+new+char[1*1024*1024];
++++++++}
++++++++//+if+you+remove+the+following+loop,+it+won't+crash
++++++++for+(i+=+0;+i+<+N;+i%2B%2B)+{
++++++++++++++++delete+ptr[i];
++++++++}
++++++++return+ptr[0][2000];
}|code-block|syntax|javascript|2772395|每次在我的系统上都会崩溃。即使在您的情况下，如果您的int只是页面上的最后一件事情，它也可能崩溃(当然，这不一定取决于标准C库的实现)，但是这需要很大的机会，并且它的实现依赖于它。|2772396|我刚刚为您创建了更有可能的崩溃案例，让相信会发生:-)|BOLD|2772397|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/Virtual_memory^0|0|18|6|27|4|0|0|0|0|Q|3|0|0|R|0^^$0|@$1|2|3|4|5|6|7|11|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|12|8|@$D|13|E|14|F|G]]|9|@$D|15|E|16|1|17]]|A|$]]|$1|H|3|I|5|6|7|18|8|@]|9|@]|A|$]]|$1|J|3|K|5|L|7|19|8|@]|9|@]|A|$M|N]]|$1|O|3|P|5|6|7|1A|8|@$D|1B|E|1C|F|G]]|9|@]|A|$]]|$1|Q|3|R|5|6|7|1D|8|@$D|1E|E|1F|F|S]]|9|@]|A|$]]|$1|T|3|-4|5|6|7|1G|8|@]|9|@]|A|$]]]|U|$V|$5|W|X|Y|A|$Z|10]]]]

<h2>Yes, it could really crash ;)</h2>
Your example is actually too simple to crash though. For your example to crash, your process (the standard C library) would have to return the memory to the Operating System in the <code>delete</code> command. Since the memory on most systems today is <a href="http://en.wikipedia.org/wiki/Virtual_memory" rel="nofollow noreferrer">organized in pages</a>, you would have to allocate memory big enough so that when its freed, the whole page is freed and returned to the OS. The segmentation fault occurs when you access memory that is not mapped - this is the case of the memory that was returned to the OS. But, you are allocating too small amount of memory for that to happen.
If you want a crash, give the system more chance :)
<pre><code>#include &lt;stdio.h&gt;
#include &lt;string.h&gt;

// number of megabytes you will allocate
#define N 100
 
int main()
{
 char *ptr[N];
 int i;

 for (i = 0; i &lt; N; i++) {
 ptr[i] = new char[1*1024*1024];
 }
 // if you remove the following loop, it won't crash
 for (i = 0; i &lt; N; i++) {
 delete ptr[i];
 }
 return ptr[0][2000];
}
</code></pre>
This crashes every time on my system. Even in your case it could crash if your <code>int</code> would be just the last thing on that page (well not surely, depends on the implementation of the standard C library), but a lot of chance would be needed for that, and its implementation dependent.
I just created more likely crash-case for you to actually believe it could happen :-)

blocks|key|964603|text|C标准只说推迟释放的指针是未定义的行为。它并没有说必须让崩溃。它并没有说明真正应该发生什么。|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|964604|你必须明白“删除”实际上是干什么的。可能内存只是被操作系统随意删除，并被标记为可供使用，但由于没有其他进程在“delete+ptr”和“返回ptr”之间占用此内存，所以这里没有分段错误，这并不令我感到惊讶。|964605|但同样，你的问题不能再被回答了，就像说它是不明确的行为一样。baheviour是什么取决于实现和操作系统，并且是随机和不可预测的(例如依赖于有时间在删除和返回之间占用这个内存的另一个进程)。|964606|entityMap^0|P|3|0|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@$9|M|A|N|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|O|8|@]|D|@]|E|$]]|$1|H|3|I|5|6|7|P|8|@]|D|@]|E|$]]|$1|J|3|-4|5|6|7|Q|8|@]|D|@]|E|$]]]|K|$]]

The C standard only says that deferencing a freed pointer is undefined behaviour. It does not say it has to crash. It says nothing about what should happen really.

You would have to understand what "delete" actually does. Probably memory is just lazyly deleted by the operating system, and marked as free for available use, but since no other process has taken ownership of this memory between the 'delete ptr' and the 'return ptr', it does not surprise me that you do not segfault here.

But again, your question cannot be answered anymore than by saying it's undefined behaviour. What the baheviour is can depend on the implementation and the operating system, and be random and unpredictable (such as dependant on another process having had time to appropriate this memory between the delete and the return).

blocks|key|2772420|text|与分割冲突(基于Thomas的例子)崩溃的案例可以是：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2772421|#include+<stdio.h>
#include+<string.h>

int+main()
{
++++++++size_t+size+=+1024*1024;
++++++++char+*ptr+=+new+char[size];
++++++++memset(ptr,255,size);
++++++++delete+[]+ptr;
++++++++return+ptr[0];
}|code-block|syntax|javascript|2772422|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

A case that crash with a segmentation violation (based on the example of Thomas) could be : 

<pre><code>#include &lt;stdio.h&gt;
#include &lt;string.h&gt;

int main()
{
 size_t size = 1024*1024;
 char *ptr = new char[size];
 memset(ptr,255,size);
 delete [] ptr;
 return ptr[0];
}
</code></pre>

The following code access to memory that is no more allocated.

<pre><code>#include &lt;stdio.h&gt;
int main()
{
 int * ptr = new int(5);
 delete ptr;
 return *ptr;
}
</code></pre>

The pointer access to memory that is no more allocated but till the memory is accessible it will just return a value.
I wonder if, practically, it is possible that the program ends crashing with a segmentation violation signal. 

EDIT: I run in a loop the program more than 100000 times without crash, that does not means it will never crash, just that it has not crashed during theses 100000 times. Perhaps it is not possible with a so simple program ?

Use freed memory could really crash ?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

下面的代码访问不再分配的内存。#include <stdio.h>int main(){ int * ptr = new int(5); delete ptr; return *ptr;}指针访问内存的权限不再分配，但在内存可访问之前，它只返回一个值。我想知道，实际上，该程序是...

问使用释放的内存真的会崩溃吗？
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问使用释放的内存真的会崩溃吗？EN